Jobverify

io.github.yessGlory17Published by GitHub account yessGlory17v0.1.0Updated Oct 24, 2026

Detect fake-recruiter and job-offer scams using free OSINT. No API keys.

Overview

AI-generated overview

JobVerify checks recruiter messages, companies, links, emails, phones and crypto wallets against free public sources to flag job-offer scams.

What you can do
Extract emails, links, phones, wallets and profile URLs from a pasted message, and match the text against known scam tactics and an overall analyze prompt that runs the full extract-check-verdict flow. Check companies and addresses against business registries and news, and check email deliverability, phone validity, usernames and GitHub organizations. Check domains for age, registrar and spoofability, find look-alike domains, and test URLs and IPs against phishing and malware blocklists. Read certificate transparency and raw email headers for origin and SPF/DKIM/DMARC mismatches. Look up crypto wallet addresses in known-scam databases and read website or profile history through the Internet
When to use it
Useful when you receive an unsolicited job offer or recruiter message and want a quick, plain-language risk read before replying, sharing details or paying anything. Also handy for checking a company name, application link, email address or wallet address that came with an offer.
Requirements
Runs locally over stdio as the PyPI package jobverify-mcp, launched with uvx, so the uv helper must be installed. No account, API keys or environment variables are needed; the checks use free public sources, so network access is required.
Before you install
Results are probabilistic decision support, not a verdict about a real person or organization, and may be incomplete or wrong. The message you paste, including emails, phone numbers and wallet addresses, is sent to third-party public sources and services such as the Internet Archive for checking. It does not log into or scrape LinkedIn.

Installation

In SourceWeft

  1. Open Jobverify in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[JobVerify]

Check whether a recruiter or job offer is real — before you reply.

[MCP server] [No API keys] [Free OSINT] [Works with Claude] [No setup — runs from GitHub]


You get a message: "We loved your profile and want to offer you a great remote job." It sounds real. The company has a logo. The recruiter has a photo. But something feels off.

JobVerify helps you find out — in seconds — whether it's genuine or a scam.

You paste the recruiter's message (or a company name, a link, or an email) and ask your AI assistant. JobVerify quietly runs the same background checks a professional investigator would, then gives you a plain-English answer: looks legit, be careful, or this is almost certainly a scam — and why.


❌ Without JobVerify

Fake recruiter and job-offer scams are everywhere, and they're convincing. On your own, you're left guessing:

  • ❌ Is this company real, or a name someone invented last week?
  • ❌ Is this "recruiter" a real person, or a stolen photo and a throwaway account?
  • ❌ Is that application link safe, or a look-alike site built to steal your data?
  • ❌ Why are they asking me to pay for equipment, or move the chat to WhatsApp/Telegram?

By the time you notice, your time, your personal details — or your money — may already be gone.

✅ With JobVerify

JobVerify cross-checks the offer against dozens of free, public information sources and combines the clues into one clear verdict:

  • ✅ Tells you if the company is a registered, real business — or nowhere to be found
  • ✅ Spots classic scam scripts (upfront fees, fake "task" jobs, crypto, "let's move off-platform")
  • ✅ Flags suspicious links, look-alike domains, and brand-new websites made to look official
  • ✅ Checks whether the email, phone, and photos actually belong to who they claim
  • ✅ Explains its reasoning in everyday language, so you can decide with confidence

No account, no sign-up, and none of your data is sold or stored. It simply helps you not get fooled.


🕵️ How it works

You don't need to learn anything technical. It's a three-step conversation:

  1. Paste it. Drop the recruiter's message, a company name, a job link, or an email into your AI chat.
  2. It investigates. JobVerify pulls out every detail — the company, links, email, phone, wallet addresses — and quietly checks each one against public records, scam databases, and website history.
  3. You get a verdict. A short, honest summary: how risky it looks, which signals are reassuring, which are red flags, and what to do next.

[!NOTE] JobVerify never logs into or scrapes LinkedIn. It only looks at information that is already public, and reads website history through the Internet Archive — the safe, legal way to check how long a profile or company page has really existed (scammers rely on brand-new throwaway accounts).


🔎 What it looks at

Think of it as a checklist a careful friend — who happens to be a fraud investigator — would run for you:

AreaThe question it answers
The messageDoes this match known scam playbooks (advance fees, fake tasks, crypto, urgency)?
The companyIs it a real, registered business? Any recent scam reports? Is the office address real?
The personIs the email real and deliverable? Is the phone valid? Are the photos/usernames reused elsewhere?
The linksIs the domain brand-new? A look-alike of a real brand? On any phishing/malware blocklist?
The moneyIs the crypto wallet they gave you already flagged in scam databases?
The historyHow long has this profile or website actually been online?

💬 Example

Ask your assistant something as simple as:

txt
Is this recruiter legit?
"Hi! I'm a talent partner at Example Corp. We loved your profile andwant to offer you a remote role at $45/hr. To get started, please purchase$200 of onboarding equipment through this link — you'll be fully reimbursedon day one. Let's continue on Telegram: @examplecorp_hr"

JobVerify will pick out Example Corp, the link, and the Telegram hand-off, check each one, and reply with something like: "⚠️ High risk — the company has no public registration, the link was registered 4 days ago, and asking you to pay upfront and move to Telegram are textbook scam signals."


🚀 Getting started

No cloning. No virtualenv. No manual install. JobVerify runs straight from GitHub — you only paste a few lines into your AI assistant's config, and it fetches and launches itself on demand.

[!NOTE] The only thing you need once is uv — a tiny, free helper that runs the tool for you:

  • macOS / Linux: curl -LsSf https://astral.sh/uv/install.sh | sh
  • Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Claude Desktop

Add this to your claude_desktop_config.json, then restart Claude:

json
{  "mcpServers": {    "jobverify": {      "command": "uvx",      "args": ["jobverify-mcp"]    }  }}

Claude Code

One line in your terminal:

bash
claude mcp add jobverify -- uvx jobverify-mcp

The first run takes a few seconds while it downloads the tool; after that it's instant.

Use it

Paste a suspicious message and ask "Is this offer legit?" — or run the built-in analyze prompt. That's it.


🔐 Privacy & honesty

  • Your data stays yours. No sign-up, no tracking, nothing you paste is stored or sold.
  • No API keys or costs. Every source is free and open — public business registries, DNS records, scam blocklists, the Internet Archive, and more.
  • Signals, not certainty. JobVerify gives you strong decision support, not a courtroom verdict. Treat the result as informed guidance about a message — never as a final judgment about a real person.

For the curious: the full toolbox

Under the hood, the AI assistant orchestrates these individual checks (all free, no keys):

ToolWhat it checks
extract_entitiesPulls emails, links, phones, wallets, and profile URLs out of a message
check_scam_patternsMatches text against known scam tactics
check_email / check_email_footprintEmail deliverability + linked social accounts
check_domain / check_domain_authDomain age, registrar, and whether it can be spoofed
check_typosquatting / find_lookalike_domainsLook-alike / imposter domains
check_url / check_ipPhishing & malware blocklists
check_certificate_transparencyA site's certificate & subdomain history
parse_email_headersOrigin, SPF/DKIM/DMARC, and mismatches in raw email headers
check_phonePhone number validity and region
check_crypto_addressKnown-scam crypto wallet databases
verify_company / search_company_news / verify_addressBusiness registration, press, and real address
check_github_org / check_usernameWhether an org/username really exists and how old it is
check_wayback / fetch_archived_pageInternet Archive history & content (the legal way to read a page)

There's also a single analyze prompt that runs the whole extract → check → verdict flow for you.


⚠️ Disclaimer

JobVerify is a decision-support tool. Its signals are probabilistic and may be incomplete or wrong. Always use your own judgment, and never treat a result as a definitive statement about any individual or organization.

License

MIT — use it, share it, and help people stay safe.

Source: README.md at commit c74ddee

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts